What users found
People asked Meta’s Muse agent to show them its entire filesystem, and it did — gigabytes of it. David Singleton, vice-president of engineering at Meta Superintelligence Labs, posted on Thursday to say this is intended.
“Today, every Muse user gets a free computer in the cloud,” he wrote. “It’s a real computer.” The runtime cell each user shares with their agent has its own root filesystem, including a full Ubuntu Linux image, separate from the host filesystem where more sensitive data lives.
Users can install software in it, write and compile code, and browse the web from it. Meta has built a file explorer into the Library tab of the interface so they can look around, including at the markdown files Muse writes to itself while working out how to answer.
Why the openness is safe, according to Meta
The argument rests on where the boundary sits. Activity inside the runtime cell is “unfettered”, Singleton wrote, but sensitive actions are overseen by a process called the Sentinel that runs outside it, and credentials entered into Muse’s secure storage are held outside it too.
Meta’s security blog, published on 8 September, gives the mechanics. The runtime cell is a systemd-nspawn container whose root is mapped to an unprivileged host user, with a separate root filesystem, a virtual network interface, filtered system calls and reduced kernel capabilities. The services that matter — prompt-injection detection, credential handling, the Sentinel that authorises connector actions and network egress — all sit outside it.
The credential design is the load-bearing part: Meta says the agent never sees real tokens, only surrogates, with the actual credentials resolved at the network boundary. That is what makes it defensible to let a user, or a prompt injection, roam the filesystem.
What it does not give you
“Poking around in this computer doesn’t give you any privileged access to Meta infrastructure, or to other people’s data,” Singleton wrote. The files a user can read are the Debian system files and the binaries and data that implement the parts of Muse running inside the cell — not Meta’s side of the system.
Users who want their own material rather than a tour of the system can export it from Settings, under Data controls.
Why this is a position, not just a feature
Every agent vendor now runs code somewhere on the user’s behalf, and almost all of them treat that environment as an implementation detail. Meta is doing the opposite: publishing the container’s contents to the person using it and arguing that transparency is affordable because the secrets are elsewhere.
It is also a bet that can be checked. An architecture described in public, on a machine the user can inspect, is one that researchers can probe — and Muse has already had one disclosed flaw this month, when a researcher reached the paired iPhone through an undocumented setting in its Mac app.
The thing to watch is whether the boundary holds under that scrutiny, not whether the filesystem is visible.
